diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest b/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest
index aa989811b9..5779294414 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/Manifest
@@ -3,8 +3,9 @@ DIST dejavu-sans-ttf-2.37.zip 417746 BLAKE2B c8904f3cd5a49370a7dc10e456684c88aea
 DIST grub-2.12-bash-completion.patch.gz 3627 BLAKE2B 6ba80fd4fb4b28ae2e5a2387133d815da126a4eaa4b5cb24b13f4ba5a2499ab4099d10ada366ed39f84be2c38774122f48e1a1894768c5bee29149528610d095 SHA512 a9ee6d2253ae48d7f90907a9e975a3a1d01346bc621d8b8cddf7cc815cd91e078f6c61392724d13556ee64f099fa15c94fcb88a49ff02d4a90ebd376252cea5c
 DIST grub-2.12.tar.xz 6675608 BLAKE2B a678f7fafb945d325c8cf47aa086f48357a8f6335b762f77038c30a3896b3b05491598d9931d5335841d224fffcbe4a9a43ca1479057c1f1ce52b8d2a952c431 SHA512 761c060a4c3da9c0e810b0ea967e3ebc66baa4ddd682a503ae3d30a83707626bccaf49359304a16b3a26fc4435fe6bea1ee90be910c84de3c2b5485a31a15be3
 DIST grub-2.12.tar.xz.sig 566 BLAKE2B 9b77fe53041b99f1196743aa6d9fc9c727b17c6512129bab2b35005f2c70f371e30521ddd804bf0c666e36cf2667247980f385ca1ac911fa9b8e0311427dc01c SHA512 fbe971d8c382578b49d33902234edd9cbd084b70820a1a56a59df4ec30874c0dd4fe27f8dc44bb380716bb7480ca68a87d120a25b92a6a10ff6c8ec1b60548d3
-DIST grub-2.14~rc1.tar.xz 7652220 BLAKE2B dededd47b4c29f1d8c6e92de78d8d90dd9fa661b5964af7033100fbd15c15e89e810db9c9127f84363425f586c3283ae4511c27f8bb69015b39582a10261a4a8 SHA512 d96e4c749caaa51393f037fd2e9d1837bef8b7b1c44655d86cdfc6447adf27bb4451fbb9e78b4846f3ee39102548b560b639f97dcf6f74563ee9afac60056c2e
-DIST grub-2.14~rc1.tar.xz.sig 566 BLAKE2B eac34a1a513a818809162a4f827191902e933e95cf3775930a8bccb18b0eb052a8bc4175fd1ba89a8dda802951b3b758f18443c65be3f8268201fa07d93ed6ce SHA512 a67766234f8d075d50381c9b94513a41d9c4a5214e5f000f182069d3318695d13c10072030f74cdfc3dc72f98f4d90fc9133b005e0af11314c754072c12299ef
+DIST grub-2.14-lld-support.tar.xz 6828 BLAKE2B 586274c56558f4b782f6bbfa511549daea4497c95f279a4aa733fe77e1ed7ddf2ced2ce803df999425c6d30d4ad888573b2ee0e69b8b14ce8102c5606bb2a311 SHA512 89522a61c174a8cf0ae7183a93f2ca01da89ff5f251c2207195408064fa882353a919b3185c784958a0e28d79d037b409a4c58a0e97e803968fa2c8c615401f2
+DIST grub-2.14.tar.xz 7725668 BLAKE2B 724bb430d8824bec39e6a025cf354a780b79260684c7c4e3d28beb08c8bee10d082a089fcb799f8f5eb6e83abcf8675fb7c5f5ddf443c5c0e61d6f180ee341af SHA512 5008e3b70072798d2b34301219fe174cc6bcfead40a9ab25fe32f30c62a392ffb7bf2eb629d481f4a6c19c2925324af3f08d7043e62623e746be2d8b3cbd1182
+DIST grub-2.14.tar.xz.sig 566 BLAKE2B a26d44082a94b95efd13738a47dc37c33142f1d486b1643100c5e61f280464513679407c13ad3d362caf83ca63dc47ad0249a4291660dbc5aa47b739502cc6b5 SHA512 3087cc4c9abd4c16e5d57f3f9fcea83af471c1a5950d487ecb93908feac537df8720bc83854328891c46f26b202a16eadeec8d1ab343c6fe269986b6f9dd2de8
 DIST unifont-15.0.06.pcf.gz 1358322 BLAKE2B 81811e3de390ca35d1a2dc1f1dee73464e97f44907ba522c218ba9c5e39ca3c9d767552780a257a97c156eb623c17786d9c0d2b67786d61df5ca33a1e10db7ca SHA512 0a28a406629c604f5cbf51f501528239a7ed50d19f93ea505bc5bdc72639e4b926b03f4b8782a5733041f7cdb4aebb9948ac7cfd5a8ad9a0fe309944e595517b
 DIST unifont-17.0.02.pcf.gz 1357145 BLAKE2B 6043055b10273930454b95bea847f4cd9cbceb7fa5f4b903a92d1e05093ed8d36b0be6cdcc96089d910b3af9b826d8bc0491070d7af568801e829fb69238d787 SHA512 8c325b8f1b872ced2a8ceffa89ce81858c4c768562711610529ae0be488dc335e333f8674cad78fe9550de222247816c435b0079bc959e6e1caebf4c7ecd2faf
 DIST unifont-17.0.02.pcf.gz.sig 566 BLAKE2B b20c3b498862b5f652bea95ca240a279674de583b2f03dc0b9ee0bac46da2513d54ca8fdcacc222adf5360da6fe919060bf41d977335d7c11a1bf9407c84c99d SHA512 f31792427adf73c0cf16f890faa579fda5315cbc0c9ac17b4d19555255f49dbf89f6333012ce99fec9819252fd7b81e07a65a2cd0d3aa54a54ded8d7c50ac186
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.14_rc1-configure.ac-avoid-bashisms.patch b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.14_rc1-configure.ac-avoid-bashisms.patch
deleted file mode 100644
index f25b94c99e..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/grub-2.14_rc1-configure.ac-avoid-bashisms.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-https://bugs.gentoo.org/965315
-
-From 5196d40b6ec6ad75e84ab98e9f4a3d71211f0d56 Mon Sep 17 00:00:00 2001
-From: Lars Wendler <polynomial-c@gmx.de>
-Date: Thu, 30 Oct 2025 07:31:59 +0100
-Subject: [PATCH] configure.ac: avoid bashisms
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-or else configure check doesn't succeed with non-bash shell (e.g. dash):
-
-  checking whether to enable AMD64 as(1) feature detection... /var/tmp/portage/sys-boot/grub-2.14_rc1/work/grub-2.14~rc1/configure: 39176: test: xx86_64: unexpected operator
-  no
-
-and later build fails with
-
-  /var/tmp/portage/sys-boot/grub-2.14_rc1/work/grub-2.14~rc1/grub-core/lib/libgcrypt-grub/src/hwf-x86.c: In function ‘detect_x86_gnuc’:
-  /var/tmp/portage/sys-boot/grub-2.14_rc1/work/grub-2.14~rc1/grub-core/lib/libgcrypt-grub/src/hwf-x86.c:252:17: error: ‘HWF_INTEL_CPU’ undeclared (first use in this function)
-    252 |       result |= HWF_INTEL_CPU;
-        |                 ^~~~~~~~~~~~~
-
-and other corresponding HWF_INTEL_* definitions because HAVE_CPU_ARCH_X86 was
-erroneously not defined by configure script.
-
-Signed-off-by: Lars Wendler <polynomial-c@gmx.de>
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 8a72c078e..17937baf4 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1150,7 +1150,7 @@ fi
- 
- # Implementation of the --disable-amd64-as-feature-detection switch.
- AC_MSG_CHECKING([whether to enable AMD64 as(1) feature detection])
--if test x$target_cpu == xx86_64 -a x$platform == xefi; then
-+if test x$target_cpu = xx86_64 -a x$platform = xefi; then
-   CPPFLAGS_GCRY_ASM="-D__x86_64 -DHAVE_CPU_ARCH_X86"
-   AC_ARG_ENABLE(amd64-as-feature-detection,
-     AS_HELP_STRING([--disable-amd64-as-feature-detection],
--- 
-2.51.1
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/sbat.csv b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/sbat.csv
deleted file mode 100644
index f85cd8eb06..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/sbat.csv
+++ /dev/null
@@ -1,3 +0,0 @@
-sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-grub,3,Free Software Foundation,grub,%PV%,https://www.gnu.org/software/grub/
-grub.gentoo,1,Gentoo,grub,%PV%,https://bugs.gentoo.org/
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/sbat.csv.in b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/sbat.csv.in
new file mode 100644
index 0000000000..1c112393e8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/files/sbat.csv.in
@@ -0,0 +1,3 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+grub,@GEN_GRUB@,Free Software Foundation,grub,@PV@,https://www.gnu.org/software/grub/
+grub.gentoo,@GEN_GENTOO@,Gentoo,grub,@PVR@,https://bugs.gentoo.org/
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r11.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r12.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r11.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r12.ebuild
index ae0dc8c093..7b91114ef2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.12-r12.ebuild
@@ -148,7 +148,8 @@ QA_MULTILIB_PATHS="usr/lib/grub/.*"
 QA_WX_LOAD="usr/lib/grub/*"
 
 pkg_setup() {
-	:
+	# skip python-any-r1_pkg_setup: python_setup is called in src_prepare
+	secureboot_pkg_setup
 }
 
 src_unpack() {
@@ -274,6 +275,14 @@ src_configure() {
 	export LEX=flex
 	unset YACC
 
+	local sedargs=(
+		-e "s/@PV@/${PV}/"
+		-e "s/@PVR@/${PVR}/"
+		-e "s/@GEN_GRUB@/4/"
+		-e "s/@GEN_GENTOO@/1/"
+	)
+	sed "${sedargs[@]}" "${FILESDIR}/sbat.csv.in" > "${WORKDIR}/sbat.csv" || die
+
 	MULTIBUILD_VARIANTS=()
 	local p
 	for p in "${GRUB_ALL_PLATFORMS[@]}"; do
@@ -380,9 +389,8 @@ src_install() {
 	# https://bugs.gentoo.org/231935
 	dostrip -x /usr/lib/grub
 
-	sed -e "s/%PV%/${PV}/" "${FILESDIR}/sbat.csv" > "${T}/sbat.csv" || die
 	insinto /usr/share/grub
-	doins "${T}/sbat.csv"
+	doins "${WORKDIR}/sbat.csv"
 
 	if use elibc_musl; then
 		# https://bugs.gentoo.org/900348
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14-r2.ebuild
similarity index 93%
rename from sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r4.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14-r2.ebuild
index b999f4f217..7d50dd838c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14_rc1-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-2.14-r2.ebuild
@@ -16,10 +16,8 @@ EAPI=8
 # If any of the above applies to a user patch, the user should set the
 # corresponding variable in make.conf or the environment.
 
+GRUB_AUTOGEN=1
 GRUB_AUTORECONF=1
-if [[ ${PV} == 9999  ]]; then
-	GRUB_BOOTSTRAP=1
-fi
 
 PYTHON_COMPAT=( python3_{11..14} )
 WANT_LIBTOOL=none
@@ -48,6 +46,7 @@ if [[ ${PV} != 9999 ]]; then
 		SRC_URI="
 			mirror://gnu/${PN}/${P}.tar.xz
 			verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+			https://dev.gentoo.org/~floppym/dist/${P}-lld-support.tar.xz
 		"
 		S=${WORKDIR}/${P%_*}
 	fi
@@ -63,13 +62,6 @@ else
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/grub.git"
 fi
 
-PATCHES=(
-	"${FILESDIR}"/gfxpayload.patch
-	"${FILESDIR}"/grub-2.02_beta2-KERNEL_GLOBS.patch
-	"${FILESDIR}"/grub-2.06-test-words.patch
-	"${FILESDIR}"/grub-2.14_rc1-configure.ac-avoid-bashisms.patch
-)
-
 DEJAVU_VER=2.37
 DEJAVU=dejavu-fonts-ttf-${DEJAVU_VER}
 UNIFONT=unifont-17.0.02
@@ -155,7 +147,8 @@ QA_MULTILIB_PATHS="usr/lib/grub/.*"
 QA_WX_LOAD="usr/lib/grub/*"
 
 pkg_setup() {
-	:
+	# skip python-any-r1_pkg_setup: python_setup is called in src_prepare
+	secureboot_pkg_setup
 }
 
 src_unpack() {
@@ -166,6 +159,9 @@ src_unpack() {
 		local GNULIB_REVISION=$(source bootstrap.conf >/dev/null; echo "${GNULIB_REVISION}")
 		git-r3_fetch "${GNULIB_URI}" "${GNULIB_REVISION}"
 		git-r3_checkout "${GNULIB_URI}" gnulib
+		if use nls; then
+			sh linguas.sh || die
+		fi
 		popd >/dev/null || die
 	elif use verify-sig; then
 		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.sig} \
@@ -179,13 +175,17 @@ src_unpack() {
 }
 
 src_prepare() {
+	local PATCHES=(
+		"${WORKDIR}/${P}-lld-support"
+	)
+
 	default
 
 	python_setup
 
 	if [[ -n ${GRUB_BOOTSTRAP} ]]; then
 		eautopoint --force
-		AUTOPOINT=: AUTORECONF=: ./bootstrap || die
+		AUTOPOINT=: AUTORECONF=: ./bootstrap --skip-po || die
 	elif [[ -n ${GRUB_AUTOGEN} ]]; then
 		FROM_BOOTSTRAP=1 ./autogen.sh || die
 	fi
@@ -283,6 +283,14 @@ src_configure() {
 	export LEX=flex
 	unset YACC
 
+	local sedargs=(
+		-e "s/@PV@/${PV}/"
+		-e "s/@PVR@/${PVR}/"
+		-e "s/@GEN_GRUB@/5/"
+		-e "s/@GEN_GENTOO@/1/"
+	)
+	sed "${sedargs[@]}" "${FILESDIR}/sbat.csv.in" > "${WORKDIR}/sbat.csv" || die
+
 	MULTIBUILD_VARIANTS=()
 	local p
 	for p in "${GRUB_ALL_PLATFORMS[@]}"; do
@@ -389,9 +397,8 @@ src_install() {
 	# https://bugs.gentoo.org/231935
 	dostrip -x /usr/lib/grub
 
-	sed -e "s/%PV%/${PV}/" "${FILESDIR}/sbat.csv" > "${T}/sbat.csv" || die
 	insinto /usr/share/grub
-	doins "${T}/sbat.csv"
+	doins "${WORKDIR}/sbat.csv"
 
 	if use elibc_musl; then
 		# https://bugs.gentoo.org/900348
@@ -418,16 +425,17 @@ pkg_postinst() {
 		ewarn
 	fi
 
-	if has_version 'sys-boot/grub:0'; then
-		elog "A migration guide for GRUB Legacy users is available:"
-		elog "    https://wiki.gentoo.org/wiki/GRUB2_Migration"
-	fi
-
 	if has_version sys-boot/os-prober; then
 		ewarn "Due to security concerns, os-prober is disabled by default."
 		ewarn "Set GRUB_DISABLE_OS_PROBER=false in /etc/default/grub to enable it."
 	fi
 
+	if grep -q GRUB_LINUX_KERNEL_GLOBS "${EROOT}"/etc/default/grub; then
+		ewarn "Support for GRUB_LINUX_KERNEL_GLOBS has been dropped."
+		ewarn "Ensure that your kernels are named appropriately or edit"
+		ewarn "/etc/grub.d/10_linux to compensate."
+	fi
+
 	if use secureboot; then
 		elog
 		elog "The signed standalone grub EFI executable(s) are available in:"
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
index 447fff13f5..1c175f9860 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/grub/grub-9999.ebuild
@@ -148,7 +148,8 @@ QA_MULTILIB_PATHS="usr/lib/grub/.*"
 QA_WX_LOAD="usr/lib/grub/*"
 
 pkg_setup() {
-	:
+	# skip python-any-r1_pkg_setup: python_setup is called in src_prepare
+	secureboot_pkg_setup
 }
 
 src_unpack() {
@@ -279,6 +280,14 @@ src_configure() {
 	export LEX=flex
 	unset YACC
 
+	local sedargs=(
+		-e "s/@PV@/${PV}/"
+		-e "s/@PVR@/${PVR}/"
+		-e "s/@GEN_GRUB@/5/"
+		-e "s/@GEN_GENTOO@/1/"
+	)
+	sed "${sedargs[@]}" "${FILESDIR}/sbat.csv.in" > "${WORKDIR}/sbat.csv" || die
+
 	MULTIBUILD_VARIANTS=()
 	local p
 	for p in "${GRUB_ALL_PLATFORMS[@]}"; do
@@ -385,9 +394,8 @@ src_install() {
 	# https://bugs.gentoo.org/231935
 	dostrip -x /usr/lib/grub
 
-	sed -e "s/%PV%/${PV}/" "${FILESDIR}/sbat.csv" > "${T}/sbat.csv" || die
 	insinto /usr/share/grub
-	doins "${T}/sbat.csv"
+	doins "${WORKDIR}/sbat.csv"
 
 	if use elibc_musl; then
 		# https://bugs.gentoo.org/900348